1. Define Anti-spoofing?

Antispoofing is a technique for identifying and dropping packets that have a

false source address

2. Explain Asymmetric Encryption?

In Asymmetric encryption, we have two different keys for encrypting and decrypting
the message or packet. We use one key for encrypting the message and another key
for decrypting the message.

3. What is the Stealth Rule?

The Stealth rule protects the checkpoint firewall from accessing the traffic directly.
We must place the Stealth rule on the top of the security role base.

4. Explain the Cleanup Rule?

We use the Cleanup rule for dropping all the traffic, which does not match the
Stealth rule and Logged. The cleanup rule is mainly useful for logging purposes.

5. Define NAT?

The full form of NAT is Network Address Translation. We use NAT for mapping
Private IP addresses with Public IP addresses and Public IP addresses with Private IP
addresses. We mainly use it for providing security to the internal servers and
network from the internet. We also use NAT for connecting the internet with the
Private IP Address.

6. Explain Source Nat?

We use Source NAT for initiating the traffic from the internal network to the external
network. In the Source NAT, we translate only Source IP in the public IP address

7. Explain Virtual Private Network(VPN)?

We use a VPN for creating a secure connection between two private networks over
the internet. VPN uses encryption authentication for securing the data during
transmission. We have three kinds of VPN:

1. Site to Site VPN

2. Remote access VPN.
 3. SSL ( web based )

8. Define IPSec?

is a set of communication rules or protocols for setting up secure connections over

a network. IPSec provides Integrity, Confidentiality, Authenticity, and Anti Replay
Protection. Following are the two types of IPSec protocols:

1. ESP(Encapsulation Security Protocol)

2. Authentication Header(AH).

9. Differentiate AH and ESP IPSec Protocol?

ESP: It is a component of the IPSec suite. It provides Confidentiality, Authenticity,

and Integrity. We can use it in two modes:

1. Transport Mode
2. Tunnel Mode.

AH: It is also a component of the IPSec suite. It provides only Integrity and
Authenticity. It does not provide encryption. We can use it in two modes:

1. Tunnel Mode
2. Transport Mode.

10. Explain the Explicit rule of the CheckPoint Firewall?

Network Security Administrator creates a rule in the rule base, and that rule is
known as the Explicit rule.

11. Explain Hide NAT?

We use Hide NAT for Translating multiple IPs or Networks with a Single Public IP
Address. It is Many to one translation. We can only use it in source NAT Translation.
We cannot use Hide NAT in Destination NAT.

12. Explain Destination NAT?

When we want to translate the Destination IP address for connecting with the
internal private network from the Public IP address, we can use only Static NAT in
the Destination NAT.

13. Explain SIC?

The full form of SIC is Secure Internal Communication. It is a feature of the

CheckPoint firewall, which we use for making the secure connection between the
CheckPoint firewall components. We use SIC when the security gateway and security
management server are available in the distributed deployment.

TCP-18209 is used for initialized the SIC communication.

TCP-18210 is used for pulling the certificates.

TCP-18211 is used for receiving the certificates

14. Explain CheckPoint Firewall Architecture?

CheckPoint has designed a Unified Security Architecture, which we implement

across all its security products. Unified Security Architecture allows us to manage
and monitor the CheckPoint products from one administrative console and offers a
consistent level of security. The CheckPoint Architecture has four components:

• Core Technologies: CheckPoint utilizes a general group of core technologies

like INSPECT for security inspection,

• Central Management: We can manage and monitor all the CheckPoint

products from a single administrative console.

• Open Architecture: The security architecture of CheckPoint is open and

compatible in a diverse environment. For instance, CheckPoint products are

compatible with other networks and security equipment from third-party

sellers to allow the collaborative implementation of security policies.

• Universal-Update Ability: CheckPoint has multiple collaborative updates

and security-alert functions to [Link] the update procedures and

helps administrators assure that security is always updated.

15. Explain Network Firewall?

A firewall is a system or set of systems that implement an access control policy

between two networks. We can consider the firewall as a pair of mechanisms: one
which blocks the traffic and the other which permits the traffic. Some firewalls aim
to block the traffic, and some firewalls aim to permit the traffic.
The most important thing in firewalls is the implementation of access control
policies. If you don’t have an idea about what type of access you want to allow or
deny, then a firewall is not useful for you.

16. Define Image and Standard CheckPoint?

Image CheckPoint

Image CheckPoint checks the image property value in our application or web page.

Standard CheckPoint

Standard CheckPoint checks the object property value in our application or web
page.

17. What are the main components of the CheckPoint solution?

Following are the main components of the CheckPoint Solution:

1. Security Gateway: The security gateway implements the security policy of

an organization and works as a security enforcement point. Security

Management Server manages the security gateway and places it on the

network as an entry point to LAN.

2. Security Management Server: System Administrator uses the security

management server for managing the security policy. We store the

organization’s databases and policies on the security management server,

and we download them to the security gateway.

3. Smart Dashboard: System Administrator uses this SmartConsole GUI

application for creating and managing the security policies.

18. How do we prevent IP Spoofing?

is a technique hackers use to gain unauthorized access to computers

Anti-Spoofing identifies whether a packet with an IP address is based on the

topology or not. For Instance, if the packet from an external network contains an
internal IP address, then Anti-spoofing blocks that packet.

19. How do we define security zones?

a group of interfaces to which a security policy can be applied to control traffic

between zones

Untrust, Trust, and DMZ zones

20. What are different kinds of Firewalls?

Following are the different kinds of firewalls:

1. Packet Filtering Firewall: Packet Filtering Firewall identifies packets and blocks
useless packets, and creates network traffic release.

2. Router-Based Firewalls: A software-based firewall exists in the Router that

offers only light filtering.

• Computer-based Firewall: It is a firewall that we store in the server with

available operating systems like Linux and windows.

• Proxy Server: Proxy Server enables all the clients to use the internet with

various access limits. Through its own firewall, the proxy server filters all

packets from the webserver.

 • Hardware-based Firewall: It is a device that allows strong security from the

public network. It is suitable for Big networks.

21. Explain the Importance of Synchronization?

In Multithreading, Synchronization is an ability to control the access of multiple

threads to the shared resources. Without Synchronization, one thread can change
the shared object while another thread is accessing or updating the value of that
object. This can lead to considerable errors.

CheckPoint Interview Questions For Experienced

22. Differentiate Router ACLs and Firewall ACLs ( Access Control List)

Routers route the traffic, not to stop it. Firewalls are useful for accepting or rejecting
traffic. But both Router ACL and Firewall ACL do the same job. According to our
requirement, we configure the ACLs.

23. Explain Circuit Level Gateway?

Circuit Level Gateway firewall works at the OSI model session layer. They control the
TCP handshaking between the packets for determining whether the requested
session is legal or not. The information we pass through the circuit level gateway to
the internet seems to have come from the Circuit level gateway.

Therefore, there is no method for a host or a remote computer for determining the
internal private IP address of an organization.

24. Explain Stateful Inception?

Stateful Inception is also called dynamic packet filtering. It is a firewall technology

that controls the condition of the active connection. Stateful inception has replaced
static packet filtering. In the static packet filtering, we only check the packet headers
indicating that an attacker can get the information through the firewall by indicating
“replay” in the header.

On the other hand, stateful inception analyzes the packets down to the application
layer. Recording the session information like IP addresses, port numbers, a dynamic
packet filter implements a security posture that a static packet filter can.

25. Explain the Demilitarized zone concept?

 A demilitarized zone is an area that runs between two territories that are
aggressive to one another or two contrary forces battle lines. A demilitarized zone
provides the buffer zone, which separates the internal network from the hostile
territory of the internet. Sometimes it is known as the “Perimeter network.”

26. What are Table CheckPoint and BitMap CheckPoint?

We use Table CheckPoint for checking the information in a table. BitMap CheckPoint
firewalls are useful for checking the images in our web pages and applications.

27. What type of connections does a firewall allow on the perimeter DMz?

Following are some of the connections that a Firewall permits on the perimeter:

1. Particular external connections

2. Outgoing connections to the internet
3. Connections to DNS Server
4. Connections from the Internal networks to the external network.
5. Outgoing connections to the internet

28. Differentiate Automatic NAT and Manual NAT?

Automatic NAT Manual NAT

1. Network Security Administrator manually creates the

1. Firewalls automatically create the Automatic NAT.
Manual NAT.

2. We cannot modify the Automatic NAT. 2. We can modify the Manual NAT.

3. We cannot create Dual NAT. 3. We can create Dual NAT.

4. In Automatic NAT, port forwarding is not possible. 4. In Manual NAT, we can do part forwarding.

29. What are the important resources in a Firewall?

1. Email
2. Disk I/o
3. Web Host
4. OS Socket Performance
5. Netnews Disk I/o

30. Differentiate Gateway and Firewall?

Network Gateway combines two networks through a combination of software and

hardware. A network firewall protects a computer network against illegitimate
outgoing or incoming access. Network firewalls can be software programs or
hardware devices.

31. Differentiate SPLAT and GAIA?

GAIA is the new version of CheckPoint, and it is a combination of SPLAT and IPSO.
Some of the advantages of GAIA are

• High Connection Capacity

• The full software blade support
• Role-based administrative users
• Native IPv6 and IPv4 support
• Manageable Dynamic Routing Suite

32. What are the two kinds of CheckPoint NG Licenses?

Following are the two kinds of CheckPoint NG Licenses:

• Central License
• Local License.

Central Licenses are the latest licensing model for NG and are limited to the
SmartCenter server. Local licenses are the heritage license model and are limited to
the enforcement module.

33. What are the functions of FWM, CPD, and FWD processes?

1. FWM: The function of the FWM process is the implementation of the

database activities of the SmartCenter server. Therefore, it is accountable for

the policy installation, LogDisplay, Database Read/Write actions, etc.

2. CPD: CPD allows us to execute various services like Secure Internal

Communication(SIC), Licensing and Status report.

3. FWD: The main function of FWD is logging. We execute it in association with

logging, security servers, and interaction with OPSEC applications.

34. What are the important features of the CheckPoint Firewall?

Following are the important features of Checkpoint Firewall:

 1. Mobile Device and VPN Connectivity
2. Internet Filtering and Access
3. Data loss Prohibition
4. Intrusion and Threat Obstruction
5. Application Control.

35. Explain Bastion Host?

A bastion host is a dedicated system that we intentionally expose on a public

network. From a secured network point-of-view, it is the only node that we expose
to the outside world, and thus, it is very vulnerable to attack. We place it outside the
firewall in one firewall system, or if the system has two firewalls, we place it
between two firewalls.

Bastion Host filters and processes the incoming traffic and averts the vicious traffic
from entering the network, serving as a gateway. General examples for bastion host
are domain name system, mail.

36. Explain Cryptographic Checksum?

Cryptographic Checksum is a one-way function that we apply to a file for producing

a unique fingerprint of the file for later reference. The checksum system is the main
method to detect filesystem tampering on the Unix system.

37. What is Authentication?

Authentication is a mechanism of deciding the identity of the user who is seeking to

access the system. Authentications verify the personal computer identity(username
and password).

38. What is Application Level Gateway?

Application-level gateway is a feature of ScreenOS gateways that allows the gateway

for parsing the application-layer payloads. Even though we have other ScreenOS
features like deep inspection, in which gateway checks traffic at the application
layer.

We use application-level gateways for supporting the applications, which use the
application layer payload for interacting with the dynamic Transmission Control
Protocol(TCP) or the User Datagram Protocol(UDP) on which applications open data
connections. The dynamic UDP, TCP, or the other ports which we open through the
ScreenOS gateway for allowing the secondary or data channels.

39. Explain Transparent Firewall

Transparent Firewalls act as a layer two device. We can configure the transparent
firewalls on the available networks. In the transparent firewall layer three traffic, we
can pass from the higher security levels to the lower security levels without the
access-list configuration.

40. Explain Packet flow in ASA?

When we get a packet at the entrance firewall, it will inspect the existing entry of the
state table. If it matches, then protocol inspection takes place on that packet. If the
packet does not match, it indicates that the Packet is a UDP packet or TCP-SYN
packet.

After that, it will send the packet for an ACL check. If ACL allows the packet, then we
will verify it through the translation rule. We translate the IP header by using NAT
translation by exit interface. After the completion of packet translation through the
exit interface, it will carry out the route lookup.

41. What are the timeouts for UDP sessions, TCP sessions, and ICMP sessions?

• For TCP sessions, the timeout is 60minutes.

• For the UDP sessions, the timeout is 2minutes.
• For the ICMP sessions, the timeout is 2seconds.

42. Explain Least Privilege?

Designing functional elements of the system will work with the least volume of
system privilege. This decreases the authentication degree at which we perform
different actions and reduces the probability that a user or a process with maximum
privileges may perform unauthorized actions that lead to security breaches.

43. Explain SIC working and different ports of SIC?

Secure Internal Communication enables CheckPoint platforms and products to

validate with each other. The SIC process produces a trusted status between
management servers, gateways, and CheckPoint components. SIC installs the
policies on the gateways for sending the logs between management servers and
gateways.

The security measures of SIC assure the safety of:

• Authentication Certificates
• Triple DES for Encryption
• Standards-based SSL for secure channel creation.

ICA(Internal Certificate Authority)

We create the ICA(Internal Certificate Authority) during the Security Management
Server Installation process. ICA issues the certificates for Authentication. For
instance, ICA issues certificates like SIC certificates for authentication reasons to
VPN certificates and administrators to gateways and users.

Starting the Trust Establishment Process

Communication initialization creates trust between the checkpoint gateways and

the security management server. This trust allows CheckPoint components to
interact securely. We can establish trust when the servers and gateways have SIC
certificates.

44. Will IPSEC make firewalls Updated?

IPSEC(IP Security) applies to a group of standards that the Internet Engineering Task
Force(IETF) develops. We have various documents that mutually specify what is
“IPSEC.” IPSEC resolves two problems that plague the IP protocol group for a long
time.

45. Define Packet Filtering?

Packet Filtering is the mechanism of blocking or passing the packets at a network

interface according to the destination, source ports, protocols, or addresses. We use
this process in conjunction with Network Address Translation and Packet Mangling.
Packet Filtering is a section of a firewall program to protect a local network from
undesirable Intrusion.

46. Explain Circuit Level Gateway?

Circuit-level gateway firewalls work at the OSI model session layer. They manage
TCP handshaking among the packets for determining whether the request is legal or
not. The information is sent using a circuit-level gateway for the internet, which
seems to come from the circuit-level gateway.

Therefore, there is no method for a remote computer or a host for determining the
internal IP address of the organization. This technique is also known as Network
Address Translation, where the private IP addresses arise from various clients.

47. Which environments are supported by the Test CheckPoint?

Test Checkpoint supports all the add-in environments.

48. What is the Importance of Firewall Rule Base?

A firewall is a key to a well-defined network security policy. The objective of the

CheckPoint firewall rule base is to create rules which allow particular connections.
49. Where can we view the CheckPoint results?

We can view the CheckPoint results in the Test Result window.

50. How Virtual Corporations manage confidentiality?

By using encryption, virtual corporations manage confidentiality.

51. packet flow in checkpoint

SAM Database-->Anti Spoofing-->Rule or Policy-->Destination NAT-->Route Lookup--
>Source NAT-->VPN-->Layer 7 Inspection -->Route.

What is a stateful inspection?

Answer: Stateful inspection was invented by checkpoint, providing accurate and

highly efficient traffic inspection. The inspection engine examines every packet as
they are intercepted at the network layer. The connection state and context
information are stored and updated dynamically in kernel table.

What is policy installation process in checkpoint firewall?

Answer:

· a. INITIATION - Policy installation is initiated by the GUI.

· b. VERIFICATION -The information in the database is verified

· c. CONVERSION- The information in the database is converted

· d. CODE GENERATION & COMPILATION- Policy is translated to the INSPECT

language and compiled with the INSPECT compiler.

· e. CPTA- checkpoint policy transfer agent transfers the policy to the firewall
gateway using SIC

· f. COMMIT- The gateway is instructed to load the new policy

What is the main purpose for the Security management server?

Answer: Security management server is used for administrative management of the

security policy, stores database and objects.

Question 5: What is the difference between standalone and distributed

installation?

Answer:

A Standalone deployment is the simplest deployment, where the management

server and the gateway are installed on the same machine.

A distributed deployment is a more complex deployment, where the gateway and

management server are deployed on different machines
Question 6: what is SIC?

Answer: Secure Internal Communication (SIC) is the checkpoint feature that ensures
components, such as Security Gateways, Security Management servers, etc. can
communicate freely and securely. The following security measures are taken to
ensure the safety of SIC

· Certificates for authentication

· Standards-based SSL for the creation of the secure channel

· 3DES for encryption

Question 7: what is Internal Certificate Authority (ICA)? Answer: ICA is created

during the management server installation process. It is responsible for issuing
certificates for:

· SIC

· VPN certificates for gateways

· Users

Question 8: What is FW unload local?

Answer. Fwunloadlocal is a command used to detach the security policy from the
local machine.

Question 9: What is stealth rule in checkpoint firewall?

Answer: Stealth rule prevents users from connecting directly to the gateway. Stealth
rule at the top of the rule base protects your gateway from port scanning, spoofing
and other types of direct attacks.

Question10: What is FW Monitor command?

Answer: FW Monitor is a packet analyzer tool available on every checkpoint security

[Link] provides Kernel level inspection and works for Layers 3 and above in OSI
model. There are four inspection points as a packet passes through the kernel (or
virtual Machine)

i ---- Before the Virtual machine, in the inbound direction (Pre-Inbound)

I ---- After the virtual machine, in the inbound direction (Post – inbound)

o ---- Before the virtual machine, in the outbound direction (Pre Outbound)

O --- After the virtual machine, in the outbound direction (Post Outbound)

Question11: What are the two types of Check Point NG licenses?

Answer: Central and Local licenses Central licenses are the new licensing model and
are bound to the Security management server. Local licenses are the legacy licensing
model and are bound to the enforcement module.

Question 12: What are the functions of CPD, FWM, and FWD processes?

Answer:

CPD – CPD is a high in the hierarchical chain and helps to execute many services,
such as Secure Internal Communication (SIC), Licensing and status report.
FWM – The FWM process is responsible for the execution of the database activities
of the Management server. It is; therefore, responsible for Policy installation,
Management High Availability (HA) Synchronization, saving the Policy, Database
Read/Write action, Log Display, etc.

FWD – The FWD process is responsible for logging. It is executed in relation to

logging, Security Servers and communication with OPSEC applications.

Question 13: What are the major differences between SPLAT and GAIA
platforms?

Answer: Gaia is the latest version of Checkpoint which is a combination of SPLAT

and IPSO. Here are some benefits of Gaia as compare to SPLAT/IPSO.

1. Web-Based user interface with Search Navigation

2. Full Software Blade support

3. High connection capacity

4. Role-Based Administrative Access

5. Intelligent Software updates

6. Native IPv4 and IPv6 Support

7. ClusterXL or VRRP Clusters

8. Manageable Dynamic Routing Suite

.Question15: What are the different Checkpoint Ports and purpose of these
ports?

Answer:

PORT TYPE SHORT DESCRIPTION

256 TCP FW1 Checkpoint Security gateway Service

257 TCP FW1_log Protocol Used for delivering logs from FWM

259 TCP FW1_clientauth_telnet ( Client Authentication )

500 UDP IPSEC IKE Protocol (formerly ISAKMP/Oakley)

900 TCP FW1_clntauth_http (Client Authentication))

4433 TCP Management server Portal

4500 UDP NAT-T NAT Traversal,

8116 UDP Check Point Cluster Control protocol (CCP)

18190 TCP CPMI Check Point Management Interface, Protocol

for communication between GUI and Management Server

18191 TCP CPD Check Point Daemon Protocol Download of rule base from
Management Server to FWM Fetching rule base from FWM to Management server.

18192 TCP CPD_amon Check Point Internal Application Monitoring

18210 TCP FW1_ica_pull Check Point Internal CA Pull

Certificate Service 18211 TCP FW1_ica_pull Check Point Internal CA Push
Certificate

Service

Question16: What’s the difference between tcpdump and fwmonitor?

Answer:

Tcpdump displays traffic coming or leaving to/from a firewall interface while

fw monitor would also tell you how the packet is going through the firewall
including routing and NAT decisions.

FW Monitor captures traffic at 4 important points in the firewall namely i, I, o & O.

You would see them in the capture in the same sequence.

TCP Dump captures at position i & O of firewall monitor, and you can be sure the
traffic has left the firewall. This is similar to the way captures work on a Cisco PIX/ASA
 Introduction

My name is vikas. I live in Noida but basically belong to kanpur . I have

done my schooling from takshishla international .and diploma in
electronics and communication engineering .After 12th I have worked for
almost 6 months with Thompson company as a L1 Technical support
engineer .After that I joined ITs as a Technical support engineer L2 .and
it has been almost 2 years and I'm still working there . I have overall 2
years experience in desktop engineer

DAY TO DAY TASK

➢ Configuring checkpoint Firewalls 13500, 5900, 6200
series.
➢ Configuring Policy Package Management.
➢ Firewall Up-gradation and Patch Management
➢ Creating Rules according to the requirement.
➢ Routing and Natting as per the requirement.
➢ Monitoring the Health of Firewalls.
➢ Configuring Application and Web Filtering.
➢ Configure SSL VPN, site to site and Remote Access VPN.
➢ Firewall Backup and Restoration.
➢ Resolving technical cases over the phone/remote support.
➢ Troubleshooting and maintaining overall LAN/ WAN
operations.
➢ Monitoring of Logs and Clustering of Firewalls.